Senior Cyber Active Threat Analyst

The Nuclear Company is the fastest growing startup in the nuclear and energy space creating a never before seen fleet-scale approach to building nuclear reactors. Through its design-once, build-many approach and coalition building across communities, regulators, and financial stakeholders, The Nuclear Company is committed to delivering safe and reliable electricity at the lowest cost, while catalyzing the nuclear industry toward rapid development in America and globally.

About the Role

As a Senior Cyber Active Threat Analyst at The Nuclear Company, you will serve as a critical member of our Security Operations Center (SOC), actively hunting for threats and analyzing adversarial behavior to protect Nuclear OS and critical nuclear infrastructure. This role combines advanced threat intelligence analysis with real-time security monitoring to detect, analyze, and respond to sophisticated cyber threats targeting mission-critical nuclear systems. You'll work at the cutting edge of nuclear cybersecurity, leveraging advanced analytics and threat intelligence to identify indicators of compromise and protect critical energy infrastructure from advanced persistent threats (APTs).

Key Responsibilities

Threat Hunting & Detection

• Proactively hunt for threats by analyzing anomalous or suspected adversarial behavior in nuclear digital systems and networks
• Identify indications of compromise including unusual network traffic, unusual file changes, and the presence of malicious code
• Detect malicious or suspicious access control or networking anomalies occurring at established defensive level boundaries and within security levels
• Identify malicious activity at the earliest possible time and take appropriate actions
• Isolate and contain malicious activity to prevent spread and minimize impact

Security Monitoring & Analysis

• Monitor SIEM systems (Security Information and Event Management) to collect, correlate, and analyze security events from multiple sources
• Analyze SIEM logs for incident indicators, identify attack vectors and entry points, and conduct root cause analysis investigations
• Monitor intrusion detection systems and network security monitoring tools to identify potential security incidents
• Correlate security events from perimeter defenses, network devices, and endpoint agent data feeds to identify threats
• Adjust monitoring tools and techniques as threat agents constantly change and adapt their tactics to circumvent defenses

Threat Intelligence & Analysis

• Develop and maintain threat intelligence on current adversarial tactics, techniques, and procedures (TTPs)
• Assess adversary threat capabilities and understand advanced persistent threat (APT) methodologies
• Analyze malicious code to understand adversary tradecraft and the functionality of specific threats
• Share threat intelligence with peer organizations, Information Sharing and Analysis Centers (ISAC), and relevant government departments
• Monitor threat landscape updates and adapt security posture based on emerging threats

Incident Response Support

• Support cybersecurity incident response team (CSIRT) functions during active incidents
• Rapidly develop appropriate responses when threats are detected, correlating new incidents with information on past intrusions
• Identify, classify, and respond to cyber security incidents and determine whether incidents are reportable
• Perform rapid forensic preservation and analysis to support incident investigations
• Track and document security incidents using automated mechanisms to assist in collection and analysis

Collaboration & Reporting

• Collaborate with integrated incident response teams including forensic analysts, malicious code analysts, and systems security engineers
• Provide detailed threat analysis reports to leadership and stakeholders on emerging threats and security posture
• Notify appropriate authorities including E-ISAC and CISA of reportable cyber security incidents
• Maintain expert skill and knowledge in cybersecurity, staying current with emerging threats and detection methodologies

Required Qualifications

• 5+ years of experience in cybersecurity with focus on threat analysis, security monitoring, or SOC operations
• Bachelor's degree in Cybersecurity, Computer Science, Information Security, or related field (or equivalent experience)
• Deep expertise in SIEM systems (Splunk, Elastic Security, or similar) including log collection, correlation, and analysis
• Strong understanding of adversarial tactics, techniques, and procedures (MITRE ATT&CK framework)<